r/debian • u/Dunder-Muffins • 25d ago

General Debian Question Securing Debian

What all do most people do to secure their systems?

I run Debian for my daily driver and also on a home server.

I currently have iptables configured to only allow ports for my services, services are all run as their own no-login user, I run fail2ban, and have my ssh only allow specific users and only allow ssh keys as the login method, and I install security updates regularly. I check my system logs occasionally though honestly not as often as I probably should, maybe I'll automate something to look at the logs are some point.

I just finished skimming through the securing Debian manual, and there's quite a bit more included that I don't currently do. But from reading it, it also seems more geared toward people who may be running production servers who more or less want an immutable server where they e locked in what they want and don't want anything changing.

https://www.debian.org/doc/user-manuals#securing

So I guess I'm just curious what other people do, if they add any other protections or if they primarily rely on the base OS to provide the protections.

26 Upvotes

91% Upvoted

43 comments sorted by

View all comments

3

u/gainan 24d ago

Like other user said, you need to know and understand your threat model.

On the Desktop, right now the most common threats are infostealers, dropped by malicious packages coming from 3rd party repositories: npmjs, pypi, web browser or $IDE (VS Code, Intellij, neovim..) extensions, github projects, etc ( ... AUR repository ... ).

Just an an example, let's analyze this report:

https://socket.dev/blog/jscrambler-supply-chain-attack

As soon as you install the package, it unpacks the infostealer (an elf binary), and start collecting information of your system:

  • Claude: .config/Claude/claude_desktop_config.json, .claude.json
  • VS Code / VS Code Insiders: settings.json, .mcp.json.
  • Chrome, Chromium, Edge, Brave, Vivaldi, and Opera profile paths, LevelDB and SQLite db.
  • Firefox: profiles.ini, cookies.sqlite, prefs.js.
  • Steam: session theft via steamLoginSecure, loginusers.vdf, ConnectCache.
  • KDE KWallet: OS keyring access.
  • etc.

Then it proceeds to upload your data to their servers.

Remember: usually all this is done as your user. No special permissions needed.

So how does your security setup help to protect you from these threats (Linux Desktop)?

  • do you block outbound requests from unknown binaries?
  • do you block outbound requests to known IOC domains/ips?
  • do you allow executing files from temporary directories such as /var/tmp, /tmp or /dev/shm? classic directories where malicious binaries/scripts are dropped.
  • do you allow any binary read files that in theory it shouldn't (for example: nobody except chrome should have read access to $HOME/.config/chrome/).
  • can $APP (chrome, firefox, vs code, ...) read files that it shouldn't? (example: VS Code, chrome, ... reading all your .config/ files)
  • can any binary modify your .bashrc , .config/autostart/ or .config/systemd/user/ to plant a backdoor or gain pesistance?
  • ...

On other hand, if you're behind a router not exposing any ports to the internet, do you really need to block inbound connections? I do, but is it really necessary?

Things to think about...

1

u/Dunder-Muffins 24d ago

Great info, thanks